Level 2 (L2) + Next Generation Windows Security (NG).Level 2 (L2) – High Security/Sensitive Data Environment (limited functionality).Level 1 (L1) + BitLocker (BL) + Next Generation Windows Security (NG).Level 1 (L1) + Next Generation Windows Security (NG).Level 1 (L1) – Corporate/Enterprise Environment (general use).Within the document there are Policy Definitions that provide IT admins options for configuring Intune to various levels of security. The benchmarks themselves come in PDF format, and the document for Windows 10 and Intune is over one thousand pages. The first step is to fill out a form, and after a couple of hours (in my case) you will receive an email with a list of different CIS Benchmarks. It should be noted that the benchmark is a little difficult to access. Although many aspects of this benchmark are still relevant to later versions of Windows 10 (it was last updated in May of 2021), there have been no updates to reflect versions past 2004 or Windows 11.

The first thought many will have, is that this latest CIS benchmark is for an OS that is now out of support as of December 14, 2021. To begin with, the CIS Microsoft Intune for Windows 10 Release 2004 Benchmark was released on May 18, 2021. Read more from Randy Franklin Smith: Windows Laptops, Remote Work and Today’s Threat Landscape CIS Benchmark In this article, I explain the guidance from each organization, while providing a gap analysis between the baselines. Many customers ask about the differences between the guidance provided by NCSC, CIS, and Microsoft’s pre-configured security baselines for Intune.

However, I was tasked recently by a client with ensuring Windows desktops are secured using benchmarks provided by the Center for Internet Security (CIS) – an independent, non-profit organization based in the United States. In the UK, the National Cyber Security Centre (NCSC), is a government entity that provides recommendations to help companies gain status such as the Cyber Essentials Plus certification. One of the most important requirements for organizations that wish to use Microsoft Intune is the security baseline of the device.

Microsoft Intune Security Baseline Policy Highlights and Lowlights.

Different Recommendations to Choose From.

Whilst this repo intends to follow a zero dependency approach, it is not practical to support Python 2.7, which is what is installed by default on CentOS 7. Use of the CIS Benchmarks are subject to the Terms of Use for Non-Member CIS Products CentOS 7 & Python 3 Passed 13 of 15 tests in 1 seconds (1 Skipped, 0 Errors) ID Description Scoring Level Result Durationĥ Access Authentication and Authorizationĥ.2.1 Ensure permissions on /etc/ssh/sshd_config are configured Scored 1 Pass 33msĥ.2.2 Ensure SSH Protocol is set to 2 Scored 1 Pass 5msĥ.2.3 Ensure SSH LogLevel is set to INFO Scored 1 Pass 6msĥ.2.4 Ensure SSH X11 forwarding is disabled Scored 1 Pass 4msĥ.2.5 Ensure SSH MaxAuthTries is set to 4 or less Scored 1 Pass 9msĥ.2.6 Ensure SSH IgnoreRhosts is enabled Scored 1 Pass 5msĥ.2.7 Ensure SSH HostbasedAuthentication is disabled Scored 1 Pass 5msĥ.2.8 Ensure SSH root login is disabled Scored 1 Fail 8msĥ.2.9 Ensure SSH PermitEmptyPasswords is disabled Scored 1 Pass 5msĥ.2.10 Ensure SSH PermitUserEnvironment is disabled Scored 1 Pass 8msĥ.2.11 Ensure only approved ciphers are used Scored 1 Pass 16msĥ.2.12 Ensure only approved MAC algorithms are used Scored 1 Pass 45msĥ.2.13 Ensure SSH Idle Timeout Interval is configured Scored 1 Fail 15msĥ.2.14 Ensure SSH LoginGraceTime is set to one minute or less Scored 1 Pass 11msĥ.2.15 Ensure SSH access is limited Skipped 1ĥ.2.16 Ensure SSH warning banner is configured Scored 1 Pass 6ms Run level 1 tests and include some but not all SELinux questions Include tests only from section 4.1 but exclude tests from section 4.1.1: Equivalent to -output tsvĮxclude tests from section 1.1 and 1.3.2: tsv Output results as tab-separated values. psv Output results as pipe-separated values. csv Output results as comma-separated values. workstation Use 'workstation' levels to determine which tests to run. server Use 'server' levels to determine which tests to run. Output redirected to a file/pipe is never coloured. Setting this overrides the -nice option.ĭisable colouring for STDOUT. This may make the tests complete faster but at the cost of putting a higher load on the server. no-nice Do not lower CPU priority for test execution. nice Lower the CPU priority for test execution. debug Run script with debug output turned on.

Ios cis benchmark script